# The NCSC-NL inventory: 674 products

Every row of the NCSC-NL php2shell software inventory at commit cca173c64ec5, with its status per CVE.

# The NCSC-NL software inventory

All 674 rows of NCSC-NL's php2shell inventory at commit `cca173c64ec5`, as parsed into the vault. Status is NCSC-NL's per CVE; the note is the first line of theirs. Licence EUPL-1.2. This page is generated from the parsed file and changes only when the vault does. [NCSC-NL](../sources/ncsc-nl-php2shell-software-list/index.html) [NCSC-NL](../sources/ncsc-nl-php2shell/index.html)

| Supplier | Product | Version | 109618 | 109619 | NCSC-NL note | Links |
|---|---|---|---|---|---|---|
| aaPanel | aaPanel PHP Project hosting and CLI selection | aaPanel PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 | Fix | Fix | CVE assessment: aaPanel staff announces patched PHP 8.2-8.5 builds in the App Store. Refresh the app list and update every installed branch; this does not confirm fixes for PHP 8.1 or earlier. | [aapanel.com](https://www.aapanel.com/docs/Function/php.html) [aapanel.com](https://www.aapanel.com/forum/d/26249-critical-php-security-update) |
| Acquia | Acquia Cloud Platform PHP hosting |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [docs.acquia.com](https://docs.acquia.com/acquia-cloud-platform/configuring-php-settings) |
| Adiscon / LogAnalyzer project | Adiscon LogAnalyzer PHP web application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/rsyslog/loganalyzer) [github.com](https://github.com/rsyslog/loganalyzer/blob/master/composer.json) |
| Adobe | Adobe Commerce |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [experienceleague.adobe.com](https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings) [experienceleague.adobe.com](https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements) |
| Adyen | Adyen API PHP library |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/adyen/php-api-library) |
| AfterLogic | AfterLogic WebMail Lite PHP |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [afterlogic.com](https://afterlogic.com/docs/webmail-lite/system-requirements) |
| Aimeos project | Aimeos Laravel package |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/aimeos/aimeos-laravel/blob/master/README.md) |
| Aimeos project | Aimeos TYPO3 extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [aimeos.org](https://aimeos.org/docs/2025.x/typo3/setup/) |
| Akaunting | Akaunting self-hosted application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/akaunting/akaunting/blob/master/composer.json) [github.com](https://github.com/akaunting/akaunting) |
| Akeneo | Akeneo PIM Community Edition |  | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | [github.com](https://github.com/akeneo/pim-community-dev/blob/master/composer.json) |
| Alpine Linux package maintainers | Alpine Linux v3.22 php84 package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pkgs.alpinelinux.org](https://pkgs.alpinelinux.org/package/v3.22/community/x86_64/php84) |
| Amazon Web Services | AWS Elastic Beanstalk PHP platform |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [docs.aws.amazon.com](https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html) |
| Amazon Web Services | AWS SDK for PHP v3 |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/aws/aws-sdk-php) [docs.aws.amazon.com](https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/getting-started_installation.html) |
| Amazon Web Services; third-party/customer PHP runtime publisher | AWS Lambda customer PHP custom-runtime option |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [bref.sh](https://bref.sh/docs/runtimes) [docs.aws.amazon.com](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html) |
| AMPHP project | AMP asynchronous PHP framework |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/amphp/amp) |
| Antagonist | Antagonist DirectAdmin PHP hosting selector |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [help.antagonist.nl](https://help.antagonist.nl/hc/nl/articles/8523972848401-Wat-kan-ik-met-de-PHP-selector-in-DirectAdmin) |
| Apache Friends | XAMPP |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [apachefriends.org](https://www.apachefriends.org/download.html) [apachefriends.org](https://www.apachefriends.org/index.html) |
| APCu / PHP extension maintainers | APCu native PHP user-cache extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/apcu) |
| API Platform project | API Platform Core |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/api-platform/core) |
| Arch Linux package maintainers | Arch Linux Extra PHP package | 8.5.12-1 | Fix | Fix | CVE assessment: Fixed in Arch Linux php 8.5.12-1 | [archlinux.org](https://archlinux.org/packages/extra/x86_64/php/) [archlinux.org](https://archlinux.org/news/update-to-php-8512-andor-php-legacy-8336-to-prevent-remote-code-execution/) |
| Arch Linux package maintainers | Arch Linux Extra php-legacy package | 8.3.36-1 | Fix | Fix | CVE assessment: Fixed in Arch Linux Extra php-legacy 8.3.36-1 | [archlinux.org](https://archlinux.org/packages/extra/x86_64/php-legacy/) [archlinux.org](https://archlinux.org/news/update-to-php-8512-andor-php-legacy-8336-to-prevent-remote-code-execution/) |
| Artefactual Systems / AtoM project | AtoM |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [accesstomemory.org](https://accesstomemory.org/en/docs/2.9/admin-manual/installation/requirements/) |
| Ascensio System SIA / ONLYOFFICE | ONLYOFFICE integration for Nextcloud |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/ONLYOFFICE/onlyoffice-nextcloud/blob/master/composer.json) [github.com](https://github.com/ONLYOFFICE/onlyoffice-nextcloud) |
| Auth0 | Auth0 PHP SDK |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/auth0/auth0-php) |
| Automattic / WordPress.com | WordPress.com plugin-enabled PHP hosting environment |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [wordpress.com](https://wordpress.com/support/php-environment/) |
| AWS SDK Common Runtime team | AWS Common Runtime native PHP extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/awscrt/1.2.7) [github.com](https://github.com/awslabs/aws-crt-php) |
| AWS SDK Common Runtime team | AWS Common Runtime PHP userland binding package |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/aws/aws-crt-php) |
| Backdrop CMS project | Backdrop CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.backdropcms.org](https://docs.backdropcms.org/documentation/system-requirements) [backdropcms.org](https://backdropcms.org/) |
| bbPress community / WordPress project | bbPress |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [wordpress.org](https://wordpress.org/plugins/bbpress/) |
| Behat project | Behat behavior-driven test framework |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/behat/behat) |
| Belnet | Belnet FileSender research/education service |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [belnet.be](https://belnet.be/nl/communities-diensten/alle-diensten/identity-mobility-federation/filesender) [docs.filesender.org](https://docs.filesender.org/filesender/v3.0/install/) |
| Ben Ramsey / Ramsey project | Ramsey UUID |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/ramsey/uuid) |
| Beyond Code in partnership with Laravel | Laravel Herd managed native PHP environment |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [herd.laravel.com](https://herd.laravel.com/) [herd.laravel.com](https://herd.laravel.com/docs/windows/advanced-usage/directories-and-files) |
| Blackfire / Platform.sh SAS doing business as Upsun | Blackfire deterministic PHP Probe native extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [docs.blackfire.io](https://docs.blackfire.io/changelogs/php-probe) [docs.blackfire.io](https://docs.blackfire.io/academy/getting-started/installation) [docs.blackfire.io](https://docs.blackfire.io/up-and-running/update) |
| Blackfire / Platform.sh SAS doing business as Upsun | Blackfire PHP SDK client library |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/blackfire/php-sdk) [docs.blackfire.io](https://docs.blackfire.io/php/integrations/sdk) |
| Bolt CMS project | Bolt CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.boltcms.io](https://docs.boltcms.io/5.2/getting-started/requirements) |
| BookStack project | BookStack | Runtime: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12, or vendor-confirmed Ubuntu backports | Fix | Fix | CVE assessment: BookStack confirms runtime fixes for its Ubuntu, Debian and Arch installations. Docker images, Home Assistant and RHEL-family packages were still awaiting fixes in the reviewed bulletin; updating BookStac | [bookstackapp.com](https://www.bookstackapp.com/docs/admin/installation/) [bookstackapp.com](https://www.bookstackapp.com/blog/php-security-release-critical/) |
| Box / Humbug project | Box PHAR build and packaging tool |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/humbug/box) |
| BoxBilling project | BoxBilling |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/boxbilling/boxbilling) |
| Bref project | Bref PHP Lambda runtime layers | Bref 3: php-85:21, php-84:24, php-83:24, php-82:26; Bref 2 layers 2.3.45: php-84[-fpm]:43, php-83[-fpm]:71, php-82[-fpm]:115 | Fix | Fix | CVE assessment: Patched Bref 3 and Bref 2 Lambda layers published in all regions; Bref 1 excluded | [bref.sh](https://bref.sh/docs/runtimes) [github.com](https://github.com/brefphp/bref/issues/2222) [bref.sh](https://bref.sh/news/06-php-security-release-october-2026) |
| Bref project | Bref PHP serverless application adapter | bref/bref 3.0.14 or 2.4.22 selecting patched runtime layers | Fix | Fix | CVE assessment: Bref identifies bref/bref 3.0.14 and 2.4.22 as selecting the patched layers. Update the adapter and redeploy; this fixes its selected PHP runtime, not an independent flaw in the adapter's PHP code. | [packagist.org](https://packagist.org/packages/bref/bref) [github.com](https://github.com/brefphp/bref/blob/master/composer.json) [bref.sh](https://bref.sh/news/06-php-security-release-october-2026) |
| Bref project | Bref v2 PHP Docker images | Bref v2 Docker tags 2 and 2.3.45: PHP 8.2.35 / 8.3.36 / 8.4.27 | Fix | Fix | CVE assessment: Fixed Bref v2 PHP Docker images published under tags 2 and 2.3.45; older cached images remain unpatched | [bref.sh](https://bref.sh/docs/runtimes) [github.com](https://github.com/brefphp/bref/issues/2222) [bref.sh](https://bref.sh/news/06-php-security-release-october-2026) |
| BuddyPress community / WordPress project | BuddyPress |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [buddypress.trac.wordpress.org](https://buddypress.trac.wordpress.org/changeset/14231) [wordpress.org](https://wordpress.org/plugins/buddypress/) |
| bunq | bunq PHP API SDK |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/bunq/sdk_php) |
| Cachet project | Cachet |  | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | [github.com](https://github.com/cachethq/cachet) [api.github.com](https://api.github.com/repos/cachethq/cachet/dependency-graph/sbom) |
| CakePHP project | CakePHP framework |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/cakephp/cakephp) |
| Canonical / Ubuntu package maintainers | Ubuntu Bionic php7.2-fpm binary package | 7.2.24-0ubuntu0.18.04.17+esm14 | Fix | Fix | CVE assessment: Fixed in Ubuntu Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14 | [ubuntu.com](https://ubuntu.com/security/notices/USN-8948-2) |
| Canonical / Ubuntu package maintainers | Ubuntu Focal php7.4-fpm binary package | 7.4.3-4ubuntu2.29+esm5 | Fix | Fix | CVE assessment: Fixed in Ubuntu Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5 | [ubuntu.com](https://ubuntu.com/security/notices/USN-8948-2) |
| Canonical / Ubuntu package maintainers | Ubuntu Jammy php8.1-fpm binary package | 8.1.2-1ubuntu2.28 | Fix | Fix | CVE assessment: Fixed in Ubuntu Jammy php8.1-fpm 8.1.2-1ubuntu2.28 | [ubuntu.com](https://ubuntu.com/security/notices/USN-8948-1) |
| Canonical / Ubuntu package maintainers | Ubuntu Noble php8.3-fpm binary package | 8.3.6-0ubuntu0.24.04.13 | Fix | Fix | CVE assessment: Fixed in Ubuntu Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13 | [packages.ubuntu.com](https://packages.ubuntu.com/noble-updates/php8.3-fpm) [ubuntu.com](https://ubuntu.com/security/notices/USN-8948-1) |
| Canonical / Ubuntu package maintainers | Ubuntu optional PHP package and SAPI family | Jammy 8.1.2-1ubuntu2.28; Noble 8.3.6-0ubuntu0.24.04.13; Resolute 8.5.4-0ubuntu1.5; Stonking 8.5.9-0ubuntu2.1 | Fix | Fix | CVE assessment: USN-8948-1 fixes both CVEs in Ubuntu's Apache-module, CGI, CLI and FPM packages for Jammy, Noble, Resolute and Stonking. This family row supplements the separately inventoried FPM release rows. | [ubuntu.com](https://ubuntu.com/server/docs/how-to/web-services/install-php/) [packages.ubuntu.com](https://packages.ubuntu.com/noble-updates/php8.3-fpm) [ubuntu.com](https://ubuntu.com/security/notices/USN-8948-1) |
| Canonical / Ubuntu package maintainers | Ubuntu Resolute php8.5-fpm binary package | 8.5.4-0ubuntu1.5 | Fix | Fix | CVE assessment: Fixed in Ubuntu Resolute php8.5-fpm 8.5.4-0ubuntu1.5 | [ubuntu.com](https://ubuntu.com/security/notices/USN-8948-1) |
| Canonical / Ubuntu package maintainers | Ubuntu Stonking php8.5-fpm binary package | 8.5.9-0ubuntu2.1 | Fix | Fix | CVE assessment: Fixed in Ubuntu Stonking php8.5-fpm 8.5.9-0ubuntu2.1 | [ubuntu.com](https://ubuntu.com/security/notices/USN-8948-1) |
| Canonical / Ubuntu package maintainers | Ubuntu Trusty php5-fpm binary package | 5.5.9+dfsg-1ubuntu4.29+esm18 | Fix | Fix | CVE assessment: Fixed in Ubuntu Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18 | [ubuntu.com](https://ubuntu.com/security/notices/USN-8948-2) |
| Canonical / Ubuntu package maintainers | Ubuntu Xenial php7.0-fpm binary package | 7.0.33-0ubuntu0.16.04.16+esm22 | Fix | Fix | CVE assessment: Fixed in Ubuntu Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22 | [ubuntu.com](https://ubuntu.com/security/notices/USN-8948-2) |
| CaptainHook / Sebastian Feldmann and contributors | CaptainHook PHP Git-hook manager |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/captainhook/captainhook) |
| CarbonPHP project | Carbon date/time library |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nesbot/carbon) |
| Catalyst IT / Mahara project | Mahara |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [manual.mahara.org](https://manual.mahara.org/en/26.04/administration/config_php.html) [mahara.org](https://mahara.org/interaction/forum/topic.php?id=10051&post38023=) |
| Centreon | Centreon Web and central-server PHP interface |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.centreon.com](https://docs.centreon.com/docs/installation/installation-of-a-central-server/using-packages/) [github.com](https://github.com/centreon/centreon-collect) |
| Chamilo Association / Chamilo project | Chamilo |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.chamilo.org](https://docs.chamilo.org/administration-guide/admin-guide/installation/server-requirements) |
| Checkmk GmbH | Checkmk Appliance | 1.7.25 | Fix | Fix | CVE assessment: Fixed in Checkmk Appliance 1.7.25 via bundled PHP 8.2.35 package update | [checkmk.com](https://checkmk.com/werks?product=cma) [download.checkmk.com](https://download.checkmk.com/appliance/1.7.25/ChangedPackages) [php.net](https://www.php.net/archive/2026.php#2026-10-21-5) |
| CIRCL, Luxembourg | CIRCL-operated MISP threat-sharing service |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [circl.lu](https://www.circl.lu/services/misp-malware-information-sharing-platform/) [circl.lu](https://www.circl.lu/doc/misp/requirements/) |
| CircleCI | CircleCI cimg/php CI runtime image family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [circleci.com](https://circleci.com/developer/images/image/cimg/php) [github.com](https://github.com/CircleCI-Public/cimg-php/blob/main/README.md) |
| Citrix / NetScaler | NetScaler ADC |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [citrix.com](https://www.citrix.com/content/dam/citrix/en_us/documents/downloads/netscaler-adc/NetScaler_ADC_ADM_FreeBSD_14.1_Third_Party_Notices.pdf) [prod-docs.netscaler.com](https://prod-docs.netscaler.com/en-us/citrix-adc/current-release/application-firewall/signatures/signature-auto-update) |
| CiviCRM project | CiviCRM |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/civicrm/civicrm-core) [docs.civicrm.org](https://docs.civicrm.org/installation/en/latest/requirements/) |
| ClassicPress project | ClassicPress |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [classicpress.net](https://www.classicpress.net/requirements/) [docs.classicpress.net](https://docs.classicpress.net/user-guides/installing-classicpress/) |
| Clever Cloud fork of Caucho Technology Quercus | Quercus CleverCloud development branch |  | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | [github.com](https://github.com/CleverCloud/Quercus) |
| Clientexec | Clientexec |  | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | [docs.clientexec.com](https://docs.clientexec.com/en/article/system-requirements-yl750s/) |
| Cloudflare | Cloudflare Pages v1 legacy PHP build image |  | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | [developers.cloudflare.com](https://developers.cloudflare.com/pages/configuration/build-image/) |
| CloudLinux | CloudLinux legacy ea-PHP extended-support packages |  | Vulnerable | Vulnerable | CVE assessment: Affected package streams: CloudLinux ea-php and broad TuxCare PHP ELS family; scoped fixed ELS rows are recorded separately | [docs.cloudlinux.com](https://docs.cloudlinux.com/cloudlinuxos/alt-ea_packages/) [cloudlinux.zendesk.com](https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability) [cloudlinux.statuspage.io](https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5) |
| CloudLinux / TuxCare | CloudLinux Alt-PHP / PHP Selector runtime family |  | Vulnerable | Vulnerable | CVE assessment: Affected family: CloudLinux Alt-PHP; scoped fixed alt-php74 and alt-php80 platform rows are recorded separately | [docs.cloudlinux.com](https://docs.cloudlinux.com/cloudlinuxos/cloudlinux_os_components/) [cloudlinux.statuspage.io](https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5) [cloudlinux.zendesk.com](https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability) |
| CloudLinux / TuxCare | CloudLinux Alt-PHP 7.4 fixed package set |  | Fix | Fix | CVE assessment: Fixed builds released for CloudLinux alt-php74 on EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 22.04, Ubuntu 24.04 and Ubuntu 26.04 | [cloudlinux.statuspage.io](https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5) |
| CloudLinux / TuxCare | CloudLinux Alt-PHP 8.0 package for Alpine Linux 3.23 |  | Fix | Fix | CVE assessment: Fixed build released for CloudLinux alt-php80 on Alpine Linux 3.23 | [cloudlinux.statuspage.io](https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5) |
| Code LTS / William Desportes and contributors | Doctum PHP API documentation generator |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/code-lts/doctum) |
| Codeception / Michael Bodnarchuk and contributors | Codeception PHP test framework |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/codeception/codeception) |
| CodeIgniter Foundation | CodeIgniter 4 framework |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/codeigniter4/framework) |
| Combodo | iTop |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/Combodo/iTop/blob/develop/composer.json) |
| Composer / Packagist project | Packagist.org open-source web application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/composer/packagist/blob/main/composer.json) [github.com](https://github.com/composer/packagist/blob/main/README.md) |
| Composer / Satis maintainers | Satis Composer repository generator |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown |  |
| Composer / Satis maintainers | Satis official PHP container build recipe |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/composer/satis/blob/main/Dockerfile) |
| Composer project | Composer |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [getcomposer.org](https://getcomposer.org/doc/articles/composer-platform-dependencies.md) [getcomposer.org](https://getcomposer.org/doc/00-intro.md) |
| Composer project / Docker Official Images | Composer default Docker runtime image |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/composer/docker/blob/a23788a1b4f65ad2dd090c3ee2a7ad9e35a7d9d1/latest/Dockerfile) [github.com](https://github.com/docker-library/official-images/blob/master/library/composer) [github.com](https://github.com/docker-library/docs/blob/master/composer/README.md) |
| Concrete CMS / PortlandLabs | Concrete CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [documentation.concretecms.org](https://documentation.concretecms.org/9-x/developers/introduction/system-requirements) |
| Contao project | Contao CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.contao.org](https://docs.contao.org/5.x/manual/en/installation/system-requirements/) |
| Contao project | Contao Manager |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.contao.org](https://docs.contao.org/5.x/manual/en/installation/contao-manager/) |
| Coolify | Coolify |  | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | [github.com](https://github.com/coollabsio/coolify/blob/main/composer.json) [api.github.com](https://api.github.com/repos/coollabsio/coolify/dependency-graph/sbom) |
| Corporation for Digital Scholarship / Omeka project | Omeka Classic |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [omeka.org](https://omeka.org/classic/docs/Installation/System_Requirements/) |
| Corporation for Digital Scholarship / Omeka project | Omeka S |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [omeka.org](https://omeka.org/s/docs/user-manual/install/) |
| Couchbase, Inc. | Couchbase native PHP SDK extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/couchbase/4.5.0) [docs.couchbase.com](https://docs.couchbase.com/php-sdk/current/project-docs/sdk-release-notes.html) [docs.couchbase.com](https://docs.couchbase.com/php-sdk/current/project-docs/sdk-full-installation.html) |
| Couchbase, Inc. | Couchbase PHP Composer SDK package |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/couchbase/couchbase) [docs.couchbase.com](https://docs.couchbase.com/php-sdk/current/project-docs/sdk-full-installation.html) |
| Couchbase, Inc. | Couchbase PHP OpenTelemetry integration |  | Investigation | Investigation | CVE assessment: Optional PHP path; CVE match unknown | [packagist.org](https://packagist.org/packages/couchbase/couchbase-opentelemetry) |
| Craft CMS / Pixel & Tonic | Craft CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [craftcms.com](https://craftcms.com/docs/5.x/requirements.html) |
| Crater Invoice | Crater |  | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | [github.com](https://github.com/crater-invoice-inc/crater/blob/master/config/installer.php) [api.github.com](https://api.github.com/repos/crater-invoice-inc/crater/dependency-graph/sbom) |
| CS-Cart | CS-Cart and Multi-Vendor |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.cs-cart.com](https://docs.cs-cart.com/latest/install/system_requirements.html) |
| CyberPanel project | CyberPanel hosted PHP / LSPHP options |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [github.com](https://github.com/usmannasir/cyberpanel) [github.com](https://github.com/usmannasir/cyberpanel/blob/v3.0.5-dev/manage.py) |
| daloRADIUS project | daloRADIUS official Docker distribution recipe |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/lirantal/daloradius/blob/master/Dockerfile) |
| daloRADIUS project | daloRADIUS PHP web management application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/lirantal/daloradius/blob/master/README.md) |
| Dan Phillimore / Uniter project | Uniter PHP-to-JavaScript runtime stack |  | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | [phptojs.com](https://phptojs.com/) |
| Datadog / Blackfire integration | Blackfire PHP continuous-profiler integration using Datadog profiling extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [docs.blackfire.io](https://docs.blackfire.io/continuous-profiling-cookbooks/php) [github.com](https://github.com/DataDog/dd-trace-php/releases) |
| DDEV project | DDEV PHP webserver development container |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [docs.ddev.com](https://docs.ddev.com/en/stable/users/configuration/config/) |
| Debian PHP Maintainers | Debian trixie PHP 8.4 FPM package | 8.4.27-1~deb13u1 | Fix | Fix | CVE assessment: Fixed in Debian trixie php8.4 8.4.27-1~deb13u1 | [packages.debian.org](https://packages.debian.org/trixie/php8.4-fpm) [lists.debian.org](https://lists.debian.org/debian-security-announce/2026/msg00489.html) |
| Deployer / Anton Medvedev and contributors | Deployer PHP deployment automation |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/deployer/deployer) |
| DEVSENSE / Phalanger project | Phalanger PHP 5.4 compiler for .NET/Mono |  | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | [github.com](https://github.com/DEVSENSE/Phalanger) |
| Docker Community / Docker Official Images, not WordPress upstream image ownership | WordPress Docker Official Image distribution |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/docker-library/wordpress/blob/master/Dockerfile.template) [github.com](https://github.com/docker-library/wordpress) |
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP Apache/mod_php image variant |  | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified | [github.com](https://github.com/docker-library/docs/blob/master/php/README.md) [github.com](https://github.com/docker-library/official-images/blob/master/library/php) [github.com](https://github.com/docker-library/php/pull/1694) |
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP CLI image variant |  | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified | [github.com](https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/alpine3.24/cli/Dockerfile) [github.com](https://github.com/docker-library/official-images/blob/master/library/php) [github.com](https://github.com/docker-library/php/pull/1694) |
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP FPM image variant |  | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified | [github.com](https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/trixie/fpm/Dockerfile) [github.com](https://github.com/docker-library/official-images/blob/master/library/php) [github.com](https://github.com/docker-library/php/pull/1694) |
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP ZTS image variant |  | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified | [github.com](https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/trixie/zts/Dockerfile) [github.com](https://github.com/docker-library/official-images/blob/master/library/php) [github.com](https://github.com/docker-library/php/pull/1694) |
| Docker Official Images maintainers | Docker Official Image: php |  | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified | [github.com](https://github.com/docker-library/official-images/blob/master/library/php) [hub.docker.com](https://hub.docker.com/_/php) [github.com](https://github.com/docker-library/docs/blob/master/php/README.md) |
| Doctrine project | Doctrine DBAL |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/doctrine/dbal) [doctrine-project.org](https://www.doctrine-project.org/projects/doctrine-dbal/en/4.4/reference/configuration.html) |
| Doctrine project | Doctrine ORM |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/doctrine/orm) |
| DokuWiki project | DokuWiki official Docker distribution |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/dokuwiki/docker/blob/main/Dockerfile) [github.com](https://github.com/dokuwiki/docker) |
| DokuWiki project / splitbrain | DokuWiki |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/dokuwiki/dokuwiki/blob/master/composer.json) |
| Dolibarr project | Dolibarr ERP CRM |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [wiki.dolibarr.org](https://wiki.dolibarr.org/index.php/Releases) [github.com](https://github.com/Dolibarr/dolibarr) |
| Drupal Commerce / Centarro | Drupal Commerce |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [drupal.org](https://www.drupal.org/project/commerce) |
| Drupal project | Drupal |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | [drupal.org](https://www.drupal.org/docs/getting-started/system-requirements/php-requirements) [drupal.org](https://www.drupal.org/project/drupal) [drupal.org](https://www.drupal.org/project/drupal/releases/11.4.10) |
| Drush project | Drush Drupal administration CLI |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/drush/drush) |
| EasyPHP project | EasyPHP PHP Devserver Windows bundle |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [easyphp.org](https://www.easyphp.org/) |
| EC-CUBE project | EC-CUBE |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/ec-cube/ec-cube) [github.com](https://github.com/EC-CUBE/ec-cube) |
| EGroupware GmbH / EGroupware project | EGroupware |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/egroupware/egroupware) [github.com](https://github.com/EGroupware/egroupware/blob/master/composer.json) |
| Elastic | Elasticsearch official PHP client |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/elasticsearch/elasticsearch) [elastic.co](https://www.elastic.co/docs/reference/elasticsearch/clients/php/installation) |
| Endor; linked by Apache Friends | Endor browser LAMP sandbox / XAMPP for Browsers |  | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | [endor.dev](https://endor.dev/s/lamp) [apachefriends.org](https://www.apachefriends.org/download.html) |
| Enhancesoft / osTicket project | osTicket |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.osticket.com](https://docs.osticket.com/en/latest/Getting%20Started/Installation.html) |
| EspoCRM project | EspoCRM |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.espocrm.com](https://docs.espocrm.com/administration/server-configuration/) |
| European Commission | EU Academy Moodle service (2023 evidence) |  | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | [interoperable-europe.ec.europa.eu](https://interoperable-europe.ec.europa.eu/collection/digital-skills-public-sector/news/eu-academy-platform-nutshell) [moodledev.io](https://moodledev.io/general/releases/5.3) |
| European Commission / OpenEuropa contributors | OpenEuropa Authentication Drupal module |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/openeuropa/oe_authentication) [github.com](https://github.com/openeuropa/oe_authentication) |
| European Commission / OpenEuropa contributors | OpenEuropa Content Drupal module |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/openeuropa/oe_content) |
| European Commission / OpenEuropa contributors | OpenEuropa Task Runner |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/openeuropa/task-runner) |
| ExpressionEngine project | ExpressionEngine |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.expressionengine.com](https://docs.expressionengine.com/latest/installation/requirements.html) |
| F5 | BIG-IP APM PHP page templates |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [techdocs.f5.com](https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/coding-tips-and-examples.html) [techdocs.f5.com](https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/advanced-customization-using-logon-page-templates.html) |
| F5 | BIG-IP TMOS platform PHP |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [cdn.f5.com](https://cdn.f5.com/product/bugtracker/ID1270257.html) [my.f5.com](https://my.f5.com/manage/s/article/K000133753) |
| Facebook / HHVM project | HHVM 3.30 PHP-compatible legacy line |  | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | [hhvm.com](https://hhvm.com/blog/2018/12/17/hhvm-3.30.html) [hhvm.com](https://hhvm.com/blog/2019/02/11/hhvm-4.0.0.html) [hhvm.com](https://hhvm.com/blog/2019/11/19/hhvm-4.32.html) |
| Facebook / HipHop project | HipHop for PHP compiler (HPHPc) |  | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | [engineering.fb.com](https://engineering.fb.com/2016/09/22/networking-traffic/redesigning-the-hhvm-jit-compiler-for-better-performance/) |
| Fedora Project PHP maintainers | Fedora PHP distribution package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packages.fedoraproject.org](https://packages.fedoraproject.org/pkgs/php/php/) |
| Feng Office | Feng Office Community Edition |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/fengoffice/fengoffice) |
| FileCloud | FileCloud Server PHP installation and maintenance |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.filecloud.com](https://docs.filecloud.com/fcdoc/latest/server/upgrade-filecloud/upgrade-using-update-tool-windows-only) |
| FileGator project | FileGator |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.filegator.io](https://docs.filegator.io/install.html) |
| FileRun | FileRun |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.filerun.com](https://docs.filerun.com/requirements) |
| FileSender project | FileSender |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.filesender.org](https://docs.filesender.org/filesender/v3.0/install/) [filesender.org](https://filesender.org/software/) |
| Firefly III project | Firefly III |  | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | [github.com](https://github.com/firefly-iii/firefly-iii) [api.github.com](https://api.github.com/repos/firefly-iii/firefly-iii/dependency-graph/sbom) |
| Flarum project / Flarum Foundation | Flarum |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.flarum.org](https://docs.flarum.org/install/) [docs.flarum.org](https://docs.flarum.org/1.x/install/) |
| Fly.io; customer runtime-image publisher | Fly.io customer Laravel/PHP Machines deployment |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [fly.io](https://fly.io/laravel/) |
| Forma LMS project | Forma LMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/formalms/formalms) |
| Fortinet | FortiADC |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [fortinetweb.s3.amazonaws.com](https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/db39ff41-6283-11f0-a9d0-d2b0d2e22f7d/fortiadc-v7.4.8-cli-reference-guide.pdf) [docs2.fortinet.com](https://docs2.fortinet.com/document/fortiadc/7.4.11/handbook/406890/solutions-by-issue-type) |
| FOSSBilling project | FOSSBilling |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.fossbilling.org](https://docs.fossbilling.org/getting-started/requirements/) [github.com](https://github.com/boxbilling/boxbilling) |
| FrankenPHP | FrankenPHP static builds |  | Vulnerable | Vulnerable | CVE assessment: Affected: FrankenPHP web-serving builds embedding affected PHP versions; fixed artifact release not yet confirmed | [frankenphp.dev](https://frankenphp.dev/docs/static/) [php.net](https://www.php.net/archive/2026.php#2026-10-21-1) [github.com](https://github.com/php/frankenphp/issues/2732) |
| FreeBSD Project / ports maintainers | FreeBSD PHP port and mod_php package integration |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [lists.freebsd.org](https://lists.freebsd.org/archives/dev-commits-ports-branches/2026-August/014722.html) [docs.freebsd.org](https://docs.freebsd.org/en/books/handbook/network-servers/) |
| FreeScout project | FreeScout |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide/393b7d2751835e7ef272f4b09ba5e38a14804ff0) [github.com](https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide) [github.com](https://github.com/freescout-help-desk/freescout) |
| FreshRSS project | FreshRSS |  | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | [freshrss.github.io](https://freshrss.github.io/FreshRSS/en/admins/02_Prerequisites.html) |
| FrontAccounting project | FrontAccounting |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/FrontAccountingERP/FA) |
| Froxlor Team | Froxlor control panel PHP branches |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/froxlor/froxlor/blob/main/composer.json) [docs.froxlor.org](https://docs.froxlor.org/v2/general/migration-guide.html) |
| FusionDirectory | FusionDirectory |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [fusiondirectory-user-manual.readthedocs.io](https://fusiondirectory-user-manual.readthedocs.io/en/1.4/fusiondirectory/prerequisite/prerequisite.html) |
| FusionDirectory | FusionDirectory Orchestrator |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [fusiondirectory-user-manual.readthedocs.io](https://fusiondirectory-user-manual.readthedocs.io/en/latest/fusiondirectory-orchestrator/prerequisite/prerequisite.html) |
| FusionPBX project | FusionPBX PHP management application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/fusionpbx/fusionpbx-install.sh/blob/master/debian/resources/php.sh) |
| Gentoo PHP maintainers | Gentoo dev-lang/php runtime package family | dev-lang/php 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later within each respective slot | Fix | Fix | CVE assessment: Gentoo GLSA 202610-02 confirms both CVEs and fixed dev-lang/php versions in the 8.2, 8.3, 8.4 and 8.5 slots on all architectures. | [packages.gentoo.org](https://packages.gentoo.org/packages/dev-lang/php) [security.gentoo.org](https://security.gentoo.org/glsa/202610-02) |
| GLPI / Teclib | GLPI |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [glpi-install.readthedocs.io](https://glpi-install.readthedocs.io/en/latest/prerequisites.html) [github.com](https://github.com/glpi-project/glpi-agent) [github.com](https://github.com/glpi-project/glpi/releases/tag/12.0.0) |
| Google | Google APIs Client Library for PHP |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/google/apiclient) |
| Google | Google Auth Library for PHP |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/google/auth) |
| Google | Google Cloud Firestore PHP client |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/google/cloud-firestore) |
| Google | Google Cloud Storage PHP client |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/google/cloud-storage) |
| Google / googleapis contributors | Google Cloud PHP client monolith |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/google/cloud) |
| Google / Protocol Buffers project | Protocol Buffers native PHP extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/protobuf/5.36.2) |
| Google / Protocol Buffers project | Protocol Buffers PHP userland runtime |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/google/protobuf) |
| Google Cloud | Google App Engine Flexible PHP runtime | App Engine Flexible PHP runtimes not redeployed onto patched supported images | Vulnerable | Vulnerable | CVE assessment: Google requires redeployment of App Engine Flexible PHP applications; existing deployments are not automatically patched. Supported base-image updates are rolling out. Custom runtimes require rebuilding w | [docs.cloud.google.com](https://docs.cloud.google.com/appengine/docs/flexible/php/runtime) [cloud.google.com](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) |
| Google Cloud | Google App Engine Standard PHP runtime | PHP 8.2+ supported runtimes | Fix | Fix | CVE assessment: Google App Engine Standard supported PHP 8.2+ runtimes are patched automatically | [docs.cloud.google.com](https://docs.cloud.google.com/appengine/docs/standard/php-gen2/runtime) [cloud.google.com](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) |
| Google Cloud; customer image publisher | Google Cloud Run customer PHP container option | Cloud Run customer containers with unpatched PHP on their respective branches | Vulnerable | Vulnerable | CVE assessment: Google requires customer-built Cloud Run PHP containers to be rebuilt and redeployed with patched PHP. The platform's own non-vulnerability statement does not make unpatched customer containers safe. | [docs.cloud.google.com](https://docs.cloud.google.com/run/docs/quickstarts/build-and-deploy/deploy-php-service) [cloud.google.com](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) |
| Grav project | Grav CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [learn.getgrav.org](https://learn.getgrav.org/2/basics/requirements) [learn.getgrav.org](https://learn.getgrav.org/17/basics/requirements) |
| Grokability / Snipe-IT project | Snipe-IT |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [snipe-it.readme.io](https://snipe-it.readme.io/docs/requirements) |
| grommunio GmbH | grommunio Web |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/grommunio/grommunio-web) |
| gRPC project | gRPC native PHP extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/gRPC/1.83.1) [pecl.php.net](https://pecl.php.net/package/gRPC/1.83.1/windows) [grpc.io](https://grpc.io/docs/languages/php/quickstart/) |
| gRPC project | gRPC PHP Composer support library |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/grpc/grpc) [grpc.io](https://grpc.io/docs/languages/php/quickstart/) [grpc.io](https://grpc.io/docs/languages/php/basics/) |
| Guzzle project | Guzzle HTTP client |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/guzzlehttp/guzzle) |
| Heroku / Salesforce | Heroku PHP buildpack and application runtime | Heroku PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; rebuilt 8.1.34 on Heroku-22 | Fix | Fix | CVE assessment: Heroku publishes fixed supported PHP runtimes and requires app redeployment. Its rebuilt PHP 8.1.34 carries the emergency backport but remains end-of-life; upgrading to a supported branch is recommended. | [devcenter.heroku.com](https://devcenter.heroku.com/articles/php-support) [devcenter.heroku.com](https://devcenter.heroku.com/changelog-items/3845) |
| Hestia Control Panel project | HestiaCP hestia-php internal runtime | Unpatched HestiaCP bundled hestia-php runtime; fix still being built | Vulnerable | Vulnerable | CVE assessment: HestiaCP's maintainer explicitly confirms its bundled hestia-php remains vulnerable while a fix is prepared. This is distinct from patched distribution PHP serving hosted websites; INI changes are not a c | [github.com](https://github.com/hestiacp/hestiacp/releases/tag/1.10.5) [hestiacp.com](https://hestiacp.com/docs/contributing/building) [hestiacp.com](https://hestiacp.com/docs/server-administration/configuration) |
| Hestia Control Panel project | HestiaCP hosted-site PHP-FPM / MultiPHP option | HestiaCP hosted-site PHP using patched distribution/Sury packages announced 2026-10-21 | Fix | Fix | CVE assessment: HestiaCP's maintainer confirms patched PHP packages are available for hosted websites. Operators must install them and restart hosted PHP; this does not fix the separately bundled hestia-php panel runtime | [hestiacp.com](https://hestiacp.com/install) [github.com](https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423) |
| HikaShop project | HikaShop Joomla component |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [hikashop.com](https://www.hikashop.com/support/documentation/hikashop/installation-configuration) |
| HippyVM contributors | HippyVM RPython PHP implementation |  | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | [github.com](https://github.com/hippyvm/hippyvm) |
| Homebrew maintainers | Homebrew PHP formula and bottles |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [formulae.brew.sh](https://formulae.brew.sh/formula/php) |
| Horde Project | Horde Groupware Webmail Edition 5 |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/horde/webmail/blob/master/composer.json) |
| HostBill / HostBillApp | HostBill |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [hostbill.atlassian.net](https://hostbill.atlassian.net/wiki/spaces/DOCS/pages/53745197/System%2Brequirements) |
| HumHub | HumHub |  | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | [docs.humhub.org](https://docs.humhub.org/docs/admin/requirements/) |
| Ibexa | Ibexa DXP |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [doc.ibexa.co](https://doc.ibexa.co/en/5.0/getting_started/requirements/) |
| Icinga GmbH | Icinga Certificate Monitoring |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [icinga.com](https://icinga.com/docs/icinga-certificate-monitoring/latest/doc/02-Installation/) [icinga.com](https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates) |
| Icinga GmbH | Icinga DB Web |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [icinga.com](https://icinga.com/docs/icinga-db-web/latest/doc/02-Installation/From-Source/) |
| Icinga GmbH | Icinga Director |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [icinga.com](https://icinga.com/docs/icinga-director/latest/doc/02-Installation/From-Source/) |
| Icinga GmbH | Icinga PDF Export |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [icinga.com](https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates) |
| Icinga GmbH | Icinga Reporting |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [icinga.com](https://icinga.com/docs/icinga-reporting/latest/doc/02-Installation/) [icinga.com](https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates) |
| Icinga GmbH | Icinga Web |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [icinga.com](https://icinga.com/docs/icinga-web/latest/doc/02-Installation/From-Source/) [icinga.com](https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates) |
| igbinary project | igbinary native PHP serializer extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/igbinary/3.2.16) [pecl.php.net](https://pecl.php.net/package/igbinary) |
| ILIAS Society / ILIAS project | ILIAS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/ILIAS-eLearning/ILIAS/blob/release_11/docs/configuration/install.md) [github.com](https://github.com/ILIAS-eLearning/ILIAS/releases) |
| Imagick project | Imagick native PHP image extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/imagick/3.8.1) [pecl.php.net](https://pecl.php.net/package/imagick) |
| iNextrix / ASTPP | ASTPP v7 PHP billing and management application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [astppbilling.org](https://astppbilling.org/your-top-questions-from-the-astpp-v7-webinar-answered) |
| Infection project | Infection PHP mutation-testing tool |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/infection/infection) |
| Invision Community / Invision Power Services | Invision Community Classic |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [invisioncommunity.com](https://invisioncommunity.com/buy/self-hosted/) |
| Invoice Ninja | Invoice Ninja self-hosted server |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/invoiceninja/invoiceninja/blob/v5-stable/composer.json) [invoiceninja.org](https://www.invoiceninja.org/getting-started/) [github.com](https://github.com/invoiceninja/invoiceninja) |
| InvoicePlane project | InvoicePlane |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/InvoicePlane/InvoicePlane/blob/develop/.github/docs/INSTALLATION.md) [github.com](https://github.com/InvoicePlane/InvoicePlane/blob/develop/composer.json) |
| IONOS | IONOS webhosting PHP and CLI options |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [ionos.com](https://www.ionos.com/help/hosting/managing-php-versions-in-the-control-panel/displaying-or-changing-php-versions/) [ionos.com](https://www.ionos.com/help/hosting/using-php-for-web-projects/executing-php-files-via-the-command-line-php-cli/) |
| ISPConfig project | ISPConfig 3 control panel UI and scripts | ISPConfig 3 installations using unpatched PHP; bulletin covers 3.2/3.3 web servers | Vulnerable | Vulnerable | CVE assessment: ISPConfig explicitly includes its control panel among applications affected through unpatched PHP. Its multipart guard is a temporary mitigation, not a runtime fix. | [ispconfig.org](https://www.ispconfig.org/blog/ispconfig-3-2-12-released/) [ispconfig.org](https://www.ispconfig.org/blog/php2shell-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/) |
| Issabel | Issabel 5 PHP communications management |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [issabel.com](https://www.issabel.com/en/release-of-issabel-5-innovation-and-advancement-in-unified-communications/) |
| Jakub Vrana / Adminer project | Adminer |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [adminer.org](https://www.adminer.org/) |
| JBMC Software / DirectAdmin | DirectAdmin CustomBuild hosted PHP | CustomBuild PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor-patched PHP 7.4 / 8.0 / 8.1 | Fix | Fix | CVE assessment: DirectAdmin staff confirms patched CustomBuild releases on current/stable channels. Rebuilding hosted PHP is required; legacy 5.6-7.3 patches were pending and PHP 8.1 compilation problems were acknowledge | [docs.directadmin.com](https://docs.directadmin.com/webservices/php/multiple-php.html) [docs.directadmin.com](https://docs.directadmin.com/webservices/php/php-options.html) [forum.directadmin.com](https://forum.directadmin.com/threads/critical-php-updates.82726/page-3) |
| JetBrains | PhpStorm external PHP interpreter integration |  | Investigation | Investigation | CVE assessment: Optional PHP path; CVE match unknown | [jetbrains.com](https://www.jetbrains.com/help/phpstorm/configuring-local-interpreter.html) |
| Joomla project | Joomla 6.x |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | [manual.joomla.org](https://manual.joomla.org/docs/get-started/technical-requirements/) |
| Jordi Boggiano / Monolog contributors | Monolog |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/monolog/monolog) |
| JPHP Group | JPHP JVM compiler and runtime |  | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | [github.com](https://github.com/jphp-group/jphp) |
| Juniper Networks | Junos OS J-Web (EX/SRX scope) |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [raw.githubusercontent.com](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json) [supportportal.juniper.net](https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-J-Web-Multiple-vulnerabilities-resolved-in-PHP-software) |
| Kanboard project | Kanboard |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.kanboard.org](https://docs.kanboard.org/v1/admin/requirements/) |
| Kevin Papst / Kimai project | Kimai | Kimai 2.70.1 rebuilt supported Docker image tags | Fix | Fix | CVE assessment: Kimai's 2.70.1 release triggers patched PHP Docker rebuilds; the maintainer subsequently confirms that supported tags have been pushed. Self-hosted non-container installations still need their own PHP run | [packagist.org](https://packagist.org/packages/kimai/kimai) [github.com](https://github.com/kimai/kimai) [github.com](https://github.com/kimai/kimai/blob/main/composer.json) |
| Kinsta | Kinsta managed WordPress PHP hosting |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [kinsta.com](https://kinsta.com/docs/wordpress-hosting/php/) |
| Kirby CMS project | Kirby CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [getkirby.com](https://getkirby.com/docs/reference/system/requirements) |
| Klemen Stirn / Hesk | Hesk Free self-hosted helpdesk |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [hesk.com](https://www.hesk.com/download.php) |
| Kopano / Kopano-dev | Kopano WebApp |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/Kopano-dev/kopano-webapp) |
| Krayin | Krayin CRM |  | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | [github.com](https://github.com/krayin/laravel-crm) [api.github.com](https://api.github.com/repos/krayin/laravel-crm/dependency-graph/sbom) |
| Ladybird Web Solution / Faveo | Faveo Helpdesk Community Edition |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.faveohelpdesk.com](https://docs.faveohelpdesk.com/docs/installation/providers/community/ubuntu-apache/) [docs.faveohelpdesk.com](https://docs.faveohelpdesk.com/docs/system-requirement/requirement/) |
| Laminas Project / Linux Foundation | Laminas MVC |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/laminas/laminas-mvc) [docs.laminas.dev](https://docs.laminas.dev/) |
| Laminas Project / Mezzio | Mezzio |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/mezzio/mezzio) [docs.laminas.dev](https://docs.laminas.dev/) |
| Lando project | Lando PHP service plugin images |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [docs.lando.dev](https://docs.lando.dev/plugins/php/index.html) |
| Laragon project | Laragon Full Windows development bundle |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [laragon.org](https://laragon.org/download) |
| Laravel | Laravel 13 framework |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | [laravel.com](https://laravel.com/framework/docs/deployment) [laravel.com](https://laravel.com/framework/docs/12.x/deployment) |
| Laravel | Laravel Cloud PHP runtime option |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [laravel.com](https://laravel.com/cloud/docs/runtimes) [laravel.com](https://laravel.com/cloud/docs/environments) |
| Laravel | Laravel Vapor core PHP invocation package |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/laravel/vapor-core) |
| Laravel | Laravel Vapor PHP Docker base image family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [docs.vapor.build](https://docs.vapor.build/projects/environments) |
| Laravel; AWS infrastructure | Laravel Vapor PHP serverless hosting configuration |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [docs.vapor.build](https://docs.vapor.build/projects/environments) |
| LDAP Account Manager project | LDAP Account Manager |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [ldap-account-manager.org](https://www.ldap-account-manager.org/static/doc/manual/ch02.html) |
| Leantime project | Leantime |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/Leantime/leantime/blob/master/composer.json) [github.com](https://github.com/Leantime/leantime) |
| LibreNMS project | LibreNMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.librenms.org](https://docs.librenms.org/Installation/Install-LibreNMS/) [github.com](https://github.com/librenms/librenms/blob/master/composer.json) |
| libsmbclient-php project | SMBClient native PHP Samba binding |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/smbclient/1.1.2) [pecl.php.net](https://pecl.php.net/package/smbclient) |
| libvirt-php contributors / Unraid distribution | Unraid libvirt-php management binding |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [docs.unraid.net](https://docs.unraid.net/unraid-os/release-notes/7.3.2/) [docs.unraid.net](https://docs.unraid.net/unraid-os/release-notes/7.4.0/) |
| Lime Technology / Unraid | Unraid PHP management runtime distribution |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [docs.unraid.net](https://docs.unraid.net/unraid-os/release-notes/7.3.2/) [docs.unraid.net](https://docs.unraid.net/unraid-os/release-notes/7.4.0/) |
| LimeSurvey GmbH / LimeSurvey project | LimeSurvey Community Edition |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [limesurvey.org](https://www.limesurvey.org/manual/Installation_-_LimeSurvey_CE) [limesurvey.org](https://www.limesurvey.org/manual/index.php?title=Installation_-_LimeSurvey_CE&oldid=385498) |
| LiveCodes project | LiveCodes PHP (Uniter) browser mode |  | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | [livecodes.io](https://livecodes.io/docs/languages/php/) |
| LiveCodes project | LiveCodes PHP (Wasm) browser mode |  | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | [livecodes.io](https://livecodes.io/docs/languages/php-wasm/) |
| Lunar project | Lunar administration panel |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/lunarphp/lunar) |
| Lunar project | Lunar commerce core |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/lunarphp/core) |
| m0n0wall project | m0n0wall legacy PHP-CGI management appliance |  | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | [m0n0.ch](https://m0n0.ch/wall/facts.php) [m0n0.ch](https://m0n0.ch/wall/end_announcement.php) |
| Mage-OS project | Mage-OS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [mage-os.org](https://mage-os.org/get-started/system-requirements/) |
| Magento / Adobe | Magento Open Source |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | [experienceleague.adobe.com](https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings) [experienceleague.adobe.com](https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements) |
| MailWatch project | MailWatch for MailScanner |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/mailwatch/MailWatch) |
| MAMP GmbH | MAMP local server environment |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [mamp.info](https://www.mamp.info/en/mamp/mac/) [mamp.info](https://www.mamp.info/en/downloads/) |
| MantisBT project | MantisBT |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/mantisbt/mantisbt) |
| Matomo | Matomo On-Premise |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [matomo.org](https://matomo.org/faq/on-premise/matomo-requirements/) [github.com](https://github.com/matomo-org/matomo/blob/5.x-dev/composer.json) |
| Matomo / InnoCraft | Matomo Analytics for WordPress |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [wordpress.org](https://wordpress.org/plugins/matomo/) |
| Matomo team | Matomo PHP tracking client |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/matomo/matomo-php-tracker) |
| Mautic project | Mautic |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.mautic.org](https://docs.mautic.org/en/7.0/getting_started/how_to_install_mautic.html) [github.com](https://github.com/mautic/mautic/blob/7.x/composer.json) |
| MediaWiki project | MediaWiki |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | [mediawiki.org](https://www.mediawiki.org/wiki/Manual:Installation_requirements) |
| MessageBird | MessageBird PHP REST API client |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/messagebird/php-rest-api) |
| Metaways / tine project | tine groupware |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.tine-groupware.de](https://docs.tine-groupware.de/main/operators/System_Requirements/) |
| Microsoft | Azure App Service PHP on Linux |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/app-service/configure-language-php) |
| Microsoft Azure Storage | Microsoft Azure Storage PHP blob client package (retired) |  | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | [packagist.org](https://packagist.org/packages/microsoft/azure-storage-blob) [github.com](https://github.com/Azure/azure-storage-php) |
| Microsoft Azure Storage | Microsoft Azure Storage PHP common client package (retired) |  | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | [packagist.org](https://packagist.org/packages/microsoft/azure-storage-common) [github.com](https://github.com/Azure/azure-storage-php) |
| Microsoft Azure Storage | Microsoft Azure Storage PHP file client package (retired) |  | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | [packagist.org](https://packagist.org/packages/microsoft/azure-storage-file) [github.com](https://github.com/Azure/azure-storage-php) |
| Microsoft Azure Storage | Microsoft Azure Storage PHP queue client package (retired) |  | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | [packagist.org](https://packagist.org/packages/microsoft/azure-storage-queue) [github.com](https://github.com/Azure/azure-storage-php) |
| Microsoft Azure Storage | Microsoft Azure Storage PHP table client package (retired) |  | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | [packagist.org](https://packagist.org/packages/microsoft/azure-storage-table) [github.com](https://github.com/Azure/azure-storage-php) |
| Microsoft Graph Client Tooling | Microsoft Graph PHP SDK |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/microsoft/microsoft-graph) |
| MISP project / CIRCL | MISP 2.5 core PHP server |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [circl.lu](https://www.circl.lu/doc/misp/requirements/) [github.com](https://github.com/MISP/MISP) |
| Mockery project | Mockery PHP test-double framework |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/mockery/mockery) |
| MODX project | MODX Revolution |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.modx.com](https://docs.modx.com/3.x/en/getting-started/server-requirements) |
| Mollie | Mollie Payments for WooCommerce |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [wordpress.org](https://wordpress.org/plugins/mollie-payments-for-woocommerce/) |
| Mollie B.V. | Mollie API PHP client |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/mollie/mollie-api-php) |
| MongoDB PHP driver team | MongoDB native PHP driver extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/mongodb/2.5.0) [php.net](https://www.php.net/manual/en/mongodb.requirements.php) |
| MongoDB PHP driver team | MongoDB PHP userland library |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/mongodb/mongodb) |
| Monica project | Monica |  | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | [github.com](https://github.com/monicahq/monica/blob/main/composer.json) [api.github.com](https://api.github.com/repos/monicahq/monica/dependency-graph/sbom) |
| Montala / ResourceSpace | ResourceSpace |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [resourcespace.com](https://www.resourcespace.com/knowledge-base/systemadmin/general_requirements?from_rs=true) |
| Moodle project | Moodle |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [moodledev.io](https://moodledev.io/general/releases/5.3) [docs.moodle.org](https://docs.moodle.org/503/en/PHP) [download.moodle.org](https://download.moodle.org/releases/latest/) |
| Moodle project / complete-installer packagers | Moodle Windows complete installer family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [download.moodle.org](https://download.moodle.org/windows/) |
| Moodle project / Ralf Krause | Moodle4Mac complete installer family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [download.moodle.org](https://download.moodle.org/macosx/) [docs.moodle.org](https://docs.moodle.org/503/en/Installation_Package_for_OS_X) |
| msgpack-php project | MessagePack native PHP serialization extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/msgpack) |
| MyBB Group | MyBB |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.mybb.com](https://docs.mybb.com/1.8/install/requirements/) |
| MyBB Group | MyBB Merge System |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [docs.mybb.com](https://docs.mybb.com/1.8/install/requirements/) |
| N-able | Mail Assure / Spam Experts |  | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | [n-able.com](https://www.n-able.com/blog/n-able-update-on-the-global-php-issue) |
| N-able | N-sight |  | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | [n-able.com](https://www.n-able.com/blog/n-able-update-on-the-global-php-issue) |
| N-able | Passportal |  | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | [n-able.com](https://www.n-able.com/blog/n-able-update-on-the-global-php-issue) |
| N-able | Take Control Session routing |  | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | [n-able.com](https://www.n-able.com/blog/n-able-update-on-the-global-php-issue) |
| Nagios Enterprises | Nagios Fusion web component subsystem |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [assets.nagios.com](https://assets.nagios.com/downloads/nagiosfusion/guides/developer/components.php) |
| Nagios Enterprises | Nagios XI web configuration-wizard subsystem |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [assets.nagios.com](https://assets.nagios.com/downloads/nagiosxi/docs/Writing-Custom-Wizards-2024.pdf) |
| Neos project | Neos CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.neos.io](https://docs.neos.io/guide/installation-development-setup/system-requirements) |
| Netgate / pfSense | pfSense management components |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [netgate.com](https://www.netgate.com/blog/the-new-gui-for-pfsense-plus) [docs.netgate.com](https://docs.netgate.com/pfsense/en/latest/development/additional-php-modules.html) [docs.netgate.com](https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html) |
| Netlify | Netlify PHP build environment and Composer integration |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [docs.netlify.com](https://docs.netlify.com/build/configure-builds/manage-dependencies/) |
| Nette community | Nette Application |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/application) |
| Nette community | Nette Assets |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/assets) |
| Nette community | Nette Bootstrap |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/bootstrap) |
| Nette community | Nette Caching |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/caching) |
| Nette community | Nette Command Line |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/command-line) |
| Nette community | Nette Database |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/database) |
| Nette community | Nette DI |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/di) |
| Nette community | Nette Forms |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/forms) |
| Nette community | Nette HTTP |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/http) |
| Nette community | Nette Mail |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/mail) |
| Nette community | Nette PHP Generator |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/php-generator) |
| Nette community | Nette RobotLoader |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/robot-loader) |
| Nette community | Nette SafeStream |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/safe-stream) |
| Nette community | Nette Security |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/security) |
| Nette community | Nette Utils |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/nette/utils) |
| Nette community / Latte | Latte template engine |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/latte/latte) |
| Nette community / Tracy | Tracy debugger |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/tracy/tracy) |
| Nette Foundation / Nette community | Nette framework metapackage |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/nette/nette) |
| Nextcloud | Nextcloud Office integration app |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/nextcloud/richdocuments/blob/main/composer.json) |
| Nextcloud | Nextcloud Server |  | Vulnerable | Vulnerable | CVE assessment: Affected: Nextcloud deployments using affected PHP versions; apply a vendor-appropriate fixed PHP runtime or rebuilt image | [github.com](https://github.com/nextcloud/server/wiki/Releases-and-PHP-versions/d90292c6b2f2d0707fc61571364185fa311525bb) [docs.nextcloud.com](https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html) [docs.nextcloud.com](https://docs.nextcloud.com/server/stable/admin_manual/installation/php_configuration.html) |
| Nextcloud | Nextcloud Talk server app |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/nextcloud/spreed/blob/main/composer.json) |
| Nextcloud Calendar project | Nextcloud Calendar server app |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [lists.freebsd.org](https://lists.freebsd.org/archives/dev-commits-ports-main/2026-October/215291.html) [github.com](https://github.com/nextcloud/calendar/blob/main/composer.json) [github.com](https://github.com/nextcloud/calendar/blob/main/README.md) |
| Nextcloud Collectives project | Nextcloud Collectives server app |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/nextcloud/collectives/blob/main/composer.json) |
| Nextcloud Contacts project | Nextcloud Contacts server app |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/nextcloud/contacts/blob/main/composer.json) |
| Nextcloud Deck project | Nextcloud Deck |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/nextcloud/deck) [github.com](https://github.com/nextcloud/deck/blob/main/composer.json) |
| Nextcloud Docker community volunteers / Docker Official Images | Nextcloud community Docker image distribution |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/nextcloud/docker) |
| Nextcloud GmbH / Nextcloud AIO maintainers | Nextcloud AIO Nextcloud application container |  | Vulnerable | Vulnerable | CVE assessment: Affected: Nextcloud AIO Nextcloud application container uses affected PHP base images; fixed AIO image release not yet confirmed | [github.com](https://github.com/nextcloud/all-in-one/blob/main/Containers/nextcloud/Dockerfile) [github.com](https://github.com/nextcloud/all-in-one/issues/8876) |
| Nextcloud Mail project | Nextcloud Mail server app |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/nextcloud/mail/blob/main/composer.json) |
| Nextcloud Notes project | Nextcloud Notes |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/nextcloud/notes/blob/main/composer.json) |
| Nextcloud Snap maintainers | Nextcloud Snap bundled PHP runtime |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/nextcloud-snap/nextcloud-snap/blob/master/snap/snapcraft.yaml) |
| NextcloudPi project / Nextcloud community | NextcloudPi turnkey PHP stack |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/nextcloud/nextcloudpi) |
| Nikita Popov / PHP-Parser contributors | PHP-Parser userland parser |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/nikic/php-parser) |
| NixOS / Nixpkgs maintainers | Nixpkgs PHP runtime environments |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [nixos.org](https://nixos.org/manual/nixpkgs/stable/) [wiki.nixos.org](https://wiki.nixos.org/w/index.php?title=PHP&oldid=33628) |
| Observium Limited / Observium project | Observium |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.observium.org](https://docs.observium.org/install_debian/) |
| October CMS project | October CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.octobercms.com](https://docs.octobercms.com/4.x/setup/installation.html) |
| Open eClass project / GUnet | Open eClass |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.openeclass.org](https://docs.openeclass.org/en/4.1/install) |
| Open Social project | Open Social Drupal installation profile |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/goalgorilla/open_social/blob/main/composer.json) |
| Open Web Analytics project | Open Web Analytics |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/master/composer.json) |
| OpenBSD ports maintainers / PHP documentation team | OpenBSD optional PHP package and ports family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [php.net](https://www.php.net/manual/en/install.unix.openbsd.php) [openbsd.org](https://www.openbsd.org/79.html) |
| OpenCart project | OpenCart |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/opencart/opencart) [github.com](https://github.com/opencart/opencart/blob/master/docs/getting-started/system-requirements.md) |
| OpenConext / SURF | OpenConext EngineBlock SAML proxy |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json) [github.com](https://github.com/OpenConext/OpenConext-engineblock) [github.com](https://github.com/OpenConext/OpenConext-engineblock/releases) |
| OpenDocMan project | OpenDocMan |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/opendocman/opendocman/blob/master/composer.json) [github.com](https://github.com/opendocman/opendocman) [opendocman.com](https://www.opendocman.com/documentation/) |
| OpenEMR project | OpenEMR |  | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | [github.com](https://github.com/openemr/openemr/blob/master/composer.json) |
| OpenMage project | OpenMage |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.openmage.org](https://docs.openmage.org/users/requirements/) [packagist.org](https://packagist.org/packages/openmage/magento-lts) |
| openmediavault project | openmediavault PHP management backend |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/openmediavault/openmediavault/blob/master/deb/openmediavault/srv/salt/omv/deploy/phpfpm/10webgui.sls) |
| OpenSearch Contributors; inherited Elastic client lineage | OpenSearch PHP client |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/opensearch-project/opensearch-php) |
| OpenSwoole project | OpenSwoole native PHP extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/openswoole/26.2.0) |
| OpenWrt packages feed maintainers | OpenWrt selectable PHP8 package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/openwrt/packages/blob/master/lang/php8/Makefile) |
| OPNsense / Deciso | OPNsense WebGUI and API |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [docs.opnsense.org](https://docs.opnsense.org/releases/CE_26.7.html) [docs.opnsense.org](https://docs.opnsense.org/development/frontend/routing.html) |
| OrangeHRM Inc. | OrangeHRM Starter |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [starterhelp.orangehrm.com](https://starterhelp.orangehrm.com/hc/en-us/articles/6187572000540-Prerequisites-for-installing-OrangeHRM-Starter-in-Linux) [github.com](https://github.com/orangehrm/orangehrm) |
| Oro Inc. | OroCommerce |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [doc.oroinc.com](https://doc.oroinc.com/backend/setup/system-requirements/) |
| Oro, Inc. | OroCRM Community Edition application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/oro/crm-application) [github.com](https://github.com/oroinc/crm-application/blob/master/composer.json) |
| osCommerce | osCommerce 4 |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [oscommerce.com](https://www.oscommerce.com/) |
| osCommerce legacy project | osCommerce Online Merchant 2.3 |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [library.oscommerce.com](https://library.oscommerce.com/Online&en&oscom_2_3&getting_started&requirements) |
| OVHcloud | OVHcloud webhosting PHP / .ovhconfig runtime |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [docs.ovhcloud.com](https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/configure-your-web-hosting) |
| ownCloud / Kiteworks | ownCloud Classic 11 |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [doc.owncloud.com](https://doc.owncloud.com/server/11.0/admin_manual/installation/installing_with_docker.html) |
| ownCloud / Kiteworks | ownCloud Server 10 |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [doc.owncloud.com](https://doc.owncloud.com/server/10.16/admin_manual/installation/system_requirements.html) |
| OXID eSales | OXID eShop |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.oxid-esales.com](https://docs.oxid-esales.com/eshop/de/7.3/installation/neu-installation/server-und-systemvoraussetzungen.html) |
| Palo Alto Networks | PAN-OS | All PAN-OS versions listed affected; fixed releases not yet announced | Vulnerable | Vulnerable | CVE assessment: Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is adde | [docs.paloaltonetworks.com](https://docs.paloaltonetworks.com/oss-listings/pan-os-oss-listings/pan-os-12-2-open-source-software-oss-listing) [security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2025-0108) [security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-109618) |
| Palo Alto Networks | Panorama | All Panorama versions listed affected; fixed releases not yet announced | Vulnerable | Vulnerable | CVE assessment: Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is adde | [docs.paloaltonetworks.com](https://docs.paloaltonetworks.com/oss-listings/panorama-oss-listings/panorama-12-2-open-source-software-oss-listing) [docs.paloaltonetworks.com](https://docs.paloaltonetworks.com/panorama/getting-started/panorama-overview/about-panorama) [security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-109618) |
| Pantheon | Pantheon managed PHP application runtime |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [docs.pantheon.io](https://docs.pantheon.io/guides/php) [docs.pantheon.io](https://docs.pantheon.io/release-notes/2026/09/php-82-83-84-85-security-updates) |
| ParaTest / Brian Scaturro, Filippo Tessarotto and contributors | ParaTest parallel PHPUnit runner |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown |  |
| Part-DB project | Part-DB server |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/Part-DB/Part-DB-server/blob/master/composer.json) [github.com](https://github.com/Part-DB/Part-DB-server) |
| Passbolt SA | Passbolt API server | Patched Docker/AMI/OVA images published 2026-10-21; runtime PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or confirmed vendor backport | Fix | Fix | CVE assessment: Passbolt confirms fixed Docker images, AWS AMI and OVA. Distribution installs need an OS PHP update and restart; existing appliances are not patched by publishing new images. Helm rollout remained in prog | [passbolt.com](https://www.passbolt.com/docs/hosting/install/ce/from-source/) [passbolt.com](https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2) |
| PayPal | PayPal Server SDK for PHP |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/paypal/paypal-server-sdk) |
| PCOV / Joe Watkins and contributors | PCOV PHP native code-coverage driver |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/pcov) [github.com](https://github.com/krakjoe/pcov) [github.com](https://github.com/krakjoe/pcov/blob/develop/INSTALL.md) |
| PeachPie / iolevel | PeachPie PHP compiler and .NET runtime |  | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | [docs.peachpie.io](https://docs.peachpie.io/about/) [peachpie.io](https://www.peachpie.io/blog/2024/08/22/peachpie-1110/) |
| PeachPie / WpDotNet project | WpDotNet compiled WordPress on PeachPie |  | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | [peachpie.io](https://www.peachpie.io/blog/2024/08/22/peachpie-1110/) |
| PEAR project / PHP Group | PEAR Base System |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [pear.php.net](https://pear.php.net/package/PEAR) [github.com](https://github.com/pear/pear-core) [pecl.php.net](https://pecl.php.net/) |
| PECL XHProf / longxinH and contributors | XHProf native PHP collection extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/xhprof/2.3.10) |
| PECL XHProf / longxinH and contributors | XHProf PHP reporting and navigation UI |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/xhprof/2.3.10) |
| PestPHP / Nuno Maduro and contributors | Pest PHP testing framework |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/pestphp/pest) [pestphp.com](https://pestphp.com/docs/installation) |
| Phalcon project | Phalcon framework PHP extension |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.phalcon.io](https://docs.phalcon.io/5.23/installation/) [docs.phalcon.io](https://docs.phalcon.io/5.9/installation/) [pecl.php.net](https://pecl.php.net/) |
| PHAR.io / Arne Blankerts, Sebastian Heuer and contributors | Phive PHAR installation and verification tool |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/phar-io/phive) |
| Phillips Data / Blesta | Blesta billing platform |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.blesta.com](https://docs.blesta.com/installation/) |
| Phing project / Michiel Rook and contributors | Phing PHP build system |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/phing/phing) |
| PHP CS Fixer project | PHP CS Fixer |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/friendsofphp/php-cs-fixer) [cs.symfony.com](https://cs.symfony.com/doc/installation.html) |
| PHP CS Fixer project | PHP CS Fixer official PHP container image family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [cs.symfony.com](https://cs.symfony.com/doc/installation.html) |
| PHP Depend project | PHP Depend source-metrics analyzer |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/pdepend/pdepend) |
| PHP Ev extension project | Ev native PHP libev binding |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/ev/1.2.3) [pecl.php.net](https://pecl.php.net/package/ev) |
| PHP Event extension project | Event native PHP libevent binding |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/event/3.1.6) [pecl.php.net](https://pecl.php.net/package/event) [php.net](https://www.php.net/manual/en/event.requirements.php) |
| PHP Gearman extension project | Gearman native PHP client and worker extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/gearman/2.2.1) [php.net](https://www.php.net/manual/en/gearman.requirements.php) |
| PHP gnupg extension project | GnuPG native PHP GPGME binding |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/gnupg/1.5.4) [php.net](https://www.php.net/manual/en/gnupg.requirements.php) [gnupg.org](https://www.gnupg.org/software/gpgme/index.html) |
| PHP Mailparse extension project | Mailparse native PHP MIME parser extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/mailparse/3.2.0) [pecl.php.net](https://pecl.php.net/package/mailparse) [php.net](https://www.php.net/manual/en/mailparse.installation.php) |
| PHP OAuth extension project | OAuth native PHP consumer extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/oauth/2.0.10) [pecl.php.net](https://pecl.php.net/package/oauth) |
| PHP SSH2 extension project | SSH2 native PHP client binding |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/ssh2/1.5.0) [pecl.php.net](https://pecl.php.net/package/ssh2) |
| PHP YAML extension project | YAML native PHP parser and emitter extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/yaml/2.3.0) [pecl.php.net](https://pecl.php.net/package/yaml) [packagist.org](https://packagist.org/packages/pecl/yaml) |
| php-amqp project | AMQP native PHP messaging client extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/amqp/2.2.0) [pecl.php.net](https://pecl.php.net/package/amqp) [github.com](https://github.com/php-amqp/php-amqp) |
| PHP-FIG | PSR logging interfaces package |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/psr/log) |
| php-memcached project | Memcached native PHP client extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/memcached/3.4.0) [pecl.php.net](https://pecl.php.net/package/memcached) [github.com](https://github.com/php-memcached-dev/php-memcached) |
| PHP-PM project | PHP-PM process manager |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/php-pm/php-pm) |
| php-rdkafka project | rdkafka native PHP Kafka client extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/rdkafka/6.0.5) [pecl.php.net](https://pecl.php.net/package/rdkafka) |
| Phpactor project | Phpactor PHP language server and refactoring tool |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/phpactor/phpactor) |
| phpBB Limited / phpBB project | phpBB |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/phpbb/phpbb) |
| PHPBench / Daniel Leech and contributors | PHPBench benchmarking framework |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/phpbench/phpbench) |
| PHPCSStandards / PHP_CodeSniffer project | PHP_CodeSniffer and PHP Code Beautifier/Fixer |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/squizlabs/php_codesniffer) [packagist.org](https://packagist.org/packages/phpcsstandards/php_codesniffer) |
| phpDocumentor project | phpDocumentor documentation generator |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/phpdocumentor/phpdocumentor) |
| phpIPAM project | phpIPAM |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/phpipam/phpipam) [phpipam.net](https://phpipam.net/documents/installation/) |
| phpLDAPadmin / leenooks project | phpLDAPadmin |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/leenooks/phpLDAPadmin/blob/master/composer.json) [github.com](https://github.com/leenooks/phpLDAPadmin) |
| phpList project | phpList |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [resources.phplist.com](https://resources.phplist.com/system/start) |
| PHPMailer project | PHPMailer |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/phpmailer/phpmailer) |
| PHPMD project | PHPMD PHP Mess Detector |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/phpmd/phpmd) |
| phpMyAdmin project | phpMyAdmin |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | [docs.phpmyadmin.net](https://docs.phpmyadmin.net/en/latest/require.html) [packagist.org](https://packagist.org/packages/phpmyadmin/phpmyadmin) |
| phpMyFAQ project | phpMyFAQ |  | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | [github.com](https://github.com/thorsten/phpMyFAQ/blob/main/composer.json) [github.com](https://github.com/thorsten/phpMyFAQ/blob/main/docs/release.md) |
| phpPgAdmin project | phpPgAdmin |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/phppgadmin/phppgadmin/blob/master/composer.json) |
| PhpRedis project / Michael Grunder and contributors | PhpRedis native PHP client extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/redis/6.3.0) [github.com](https://github.com/phpredis/phpredis/blob/develop/INSTALL.md) [github.com](https://github.com/phpredis/phpredis/blob/develop/config.m4) |
| PHPro / GrumPHP contributors | GrumPHP Git quality-check orchestration |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown |  |
| phpseclib project | phpseclib |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/phpseclib/phpseclib) |
| PhpSpec project | PhpSpec specification test runner |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown |  |
| PHPStan / Ondrej Mirtes and contributors | PHPStan static analyzer |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown |  |
| PHPStan project | PHPStan PHPDoc parser library |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown |  |
| PHPUnit project | PHPUnit test framework |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/phpunit/phpunit) [docs.phpunit.de](https://docs.phpunit.de/en/12.5/installation.html) [docs.phpunit.de](https://docs.phpunit.de/en/13.4/installation.html) |
| PHPUnit project / Sebastian Bergmann | PHPUnit PHP code-coverage library |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/phpunit/php-code-coverage) |
| phpVirtualBox project | phpVirtualBox server-side administration application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/phpvirtualbox/phpvirtualbox) |
| Pi-hole project | Pi-hole v5 legacy PHP web interface |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [pi-hole.net](https://pi-hole.net/blog/2025/02/18/introducing-pi-hole-v6/) |
| Pimcore project | Pimcore Platform |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.pimcore.com](https://docs.pimcore.com/platform/2026.2/Getting_Started/Installation/System_Requirements/) [docs.pimcore.com](https://docs.pimcore.com/platform/2025.1/Pimcore/Installation_and_Upgrade/System_Requirements/) |
| Plesk | Plesk for Linux | All shipped PHP versions | Vulnerable | Vulnerable | CVE assessment: Affected: all PHP versions shipped with Plesk | [support.plesk.com](https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk) |
| Plesk | Plesk for Windows | All shipped PHP versions | Vulnerable | Vulnerable | CVE assessment: Affected: all PHP versions shipped with Plesk | [support.plesk.com](https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk) |
| Plesk | Plesk Obsidian hosted-site PHP |  | Vulnerable | Vulnerable | CVE assessment: Affected hosted Plesk PHP in aggregate: Linux PHP 7.4, 8.0 and 8.1 plus Windows PHP 8.2-8.5 remain affected; fixed Linux PHP 8.2-8.5 builds are available | [docs.plesk.com](https://docs.plesk.com/release-notes/obsidian/change-log/) [docs.plesk.com](https://docs.plesk.com/en-US/obsidian/administrator-guide/web-hosting/php-management/installing-php.75153/) [support.plesk.com](https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk) |
| Plesk | Plesk plesk-engine internal PHP management runtime for Windows |  | Vulnerable | Vulnerable | CVE assessment: Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4 | [docs.plesk.com](https://docs.plesk.com/release-notes/obsidian/change-log/) [support.plesk.com](https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk) |
| Plesk | Plesk sw-engine internal PHP management runtime |  | Vulnerable | Vulnerable | CVE assessment: Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4 | [docs.plesk.com](https://docs.plesk.com/release-notes/obsidian/change-log/) [support.plesk.com](https://support.plesk.com/hc/en-us/articles/31743316866071-The-sw-engine-process-causes-high-CPU-usage-on-a-Plesk-server) [support.plesk.com](https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk) |
| PluXml project | PluXml 5.8 documented branch |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [wiki.pluxml.org](https://wiki.pluxml.org/docs/install/install.html) |
| PmWiki project | PmWiki |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [pmwiki.org](https://www.pmwiki.org/wiki/PmWiki/Requirements) |
| PostfixAdmin project | PostfixAdmin |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/postfixadmin/postfixadmin) |
| Predis project / Till Kruss and contributors | Predis PHP Redis and Valkey client |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/predis/predis) |
| PrestaShop project | PrestaShop |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [devdocs.prestashop-project.org](https://devdocs.prestashop-project.org/9/basics/installation/system-requirements/) |
| PrivateBin project | PrivateBin |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/PrivateBin/PrivateBin/blob/master/composer.json) [github.com](https://github.com/PrivateBin/PrivateBin) |
| ProcessWire project | ProcessWire CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [processwire.com](https://processwire.com/about/requirements/) [processwire.com](https://processwire.com/docs/front-end/include/) |
| ProjectSend project | ProjectSend |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/projectsend/projectsend/blob/main/INSTALL.md) [docs.projectsend.org](https://docs.projectsend.org/about/installation/requirements) |
| Prophecy / PhpSpec project | Prophecy PHP mocking library |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown |  |
| Psalm project / Daniil Gentili | Psalm official custom-PHP container image |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [psalm.dev](https://psalm.dev/docs/running_psalm/installation/) |
| Psalm project / Matthew Brown, Daniil Gentili and contributors | Psalm PHP static analyzer |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown |  |
| PsySH / Justin Hileman and contributors | PsySH interactive PHP shell |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown |  |
| Pterodactyl project | Pterodactyl Panel PHP application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/pterodactyl/panel/blob/1.0-develop/composer.json) [github.com](https://github.com/pterodactyl/wings/blob/develop/go.mod) |
| Public Knowledge Project (PKP) | Open Journal Systems |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/pkp/ojs/blob/main/README.md) |
| Public Knowledge Project (PKP) | Open Monograph Press |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/pkp/omp) |
| Public Knowledge Project (PKP) | Open Preprint Systems |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/pkp/ops) |
| Pydio | Pydio 8 Enterprise Distribution |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.pydio.com](https://docs.pydio.com/pydio-v8/admin-guide/installation-guide/pydio-requirements/) [github.com](https://github.com/pydio/cells) |
| QloApps | QloApps |  | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | [github.com](https://github.com/Qloapps/QloApps) [api.github.com](https://api.github.com/repos/Qloapps/QloApps/dependency-graph/sbom) |
| QNAP | QNAP PHP7.4 optional application before5.2 migration |  | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | [qnap.com](https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520) |
| QNAP | QNAP QTS built-in PHP runtime |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [qnap.com](https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520) [qnap.com](https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero) |
| QNAP | QNAP QuTS hero built-in PHP runtime |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [qnap.com](https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520) [qnap.com](https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero) |
| Quest Software | KACE Systems Management Appliance |  | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | [support.quest.com](https://support.quest.com/kace-systems-management-appliance/kb/4385046/4385046) [support.quest.com](https://support.quest.com/kace-systems-management-appliance/rss) |
| RainLoop Team | RainLoop Webmail |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [rainloop.net](https://www.rainloop.net/docs/system-requirements/) [github.com](https://github.com/RainLoop/rainloop-webmail) |
| RaspAP project | RaspAP PHP network-management web GUI |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.raspap.com](https://docs.raspap.com/get-started/manual/) |
| ReactPHP project | ReactPHP EventLoop |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/react/event-loop) |
| Rector project | Rector automated PHP refactoring tool |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown |  |
| Red Hat | Red Hat Enterprise Linux 9 PHP RPM/AppStreams |  | Vulnerable | Vulnerable | CVE assessment: Affected: Red Hat lists the RHEL 9 PHP component family as affected; scoped php:8.2 fix recorded separately | [docs.redhat.com](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/installing_and_using_dynamic_programming_languages/installing_and_using_dynamic_programming_languages) [access.redhat.com](https://access.redhat.com/support/policy/updates/rhel-app-streams-life-cycle) [access.redhat.com](https://access.redhat.com/security/cve/cve-2026-109618) |
| Red Hat | Red Hat Enterprise Linux 9 php:8.2 module | 8.2.35-1.module+el9.8.0+25111+a1450321 | Fix | Fix | CVE assessment: Fixed in Red Hat Enterprise Linux 9 php:8.2 module package php-8.2.35-1.module+el9.8.0+25111+a1450321 | [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:87072) |
| Render; customer/base-image publisher | Render customer PHP Docker hosting |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [render.com](https://render.com/docs/deploy-php-laravel-docker) [render.com](https://render.com/docs/docker) |
| RoadRunner PHP community | RoadRunner common PHP worker package |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/roadrunner/worker) [packagist.org](https://packagist.org/packages/spiral/roadrunner-worker) |
| RoadRunner project | RoadRunner configured PHP worker-pool integration |  | Investigation | Investigation | CVE assessment: Optional PHP path; CVE match unknown | [docs.roadrunner.dev](https://docs.roadrunner.dev/docs/php-worker/pool) |
| Roave | Roave backward-compatibility checker |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown |  |
| Roundcube project | Roundcube Webmail |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | [github.com](https://github.com/roundcube/roundcubemail) [packagist.org](https://packagist.org/packages/roundcube/roundcubemail) [github.com](https://github.com/roundcube/roundcubemail/blob/master/composer.json) |
| Roundcube project | Roundcube Webmail Docker image family | Unrebuilt Roundcube Docker variants using pre-fix PHP 8.4 base images | Vulnerable | Vulnerable | CVE assessment: Roundcube's maintainer confirms that image rebuilds are needed after patched PHP base images arrive and reports build failures. No complete set of published fixed Roundcube tags is confirmed in the review | [github.com](https://github.com/roundcube/roundcubemail-docker) [github.com](https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6321479744) |
| SalesAgility / SuiteCRM project | SuiteCRM |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.suitecrm.com](https://docs.suitecrm.com/8.x/admin/compatibility-matrix/) [docs.suitecrm.com](https://docs.suitecrm.com/admin/compatibility-matrix/) |
| Sangoma | PBXact 17 PHP management edition |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [freepbx.org](https://www.freepbx.org/pbxact-17-general-availability-announcement/) |
| Sangoma / FreePBX project | FreePBX 17 management framework |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [sangomakb.atlassian.net](https://sangomakb.atlassian.net/wiki/spaces/FP/pages/279052296) [github.com](https://github.com/FreePBX/framework/blob/release/17.0/install.php) |
| Scalingo | Scalingo PaaS |  | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | [doc.scalingo.com](https://doc.scalingo.com/security/bulletins/ssb-2026-005) |
| Scalingo | Scalingo PHP buildpack |  | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | [doc.scalingo.com](https://doc.scalingo.com/security/bulletins/ssb-2026-005) |
| Sean Morris / php-wasm project | php-cgi-wasm package (Sean Morris) |  | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | [github.com](https://github.com/seanmorris/php-wasm) |
| Sean Morris / php-wasm project | php-cli-wasm package (Sean Morris) |  | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | [github.com](https://github.com/seanmorris/php-wasm) |
| Sean Morris / php-wasm project | php-cloud-wasm package (Sean Morris) |  | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | [github.com](https://github.com/seanmorris/php-wasm) |
| Sean Morris / php-wasm project | php-dbg-wasm package (Sean Morris) |  | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | [github.com](https://github.com/seanmorris/php-wasm) |
| Sean Morris / php-wasm project | php-sdl-wasm package (Sean Morris) |  | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | [github.com](https://github.com/seanmorris/php-wasm) |
| Sean Morris / php-wasm project | php-wasm-builder package (Sean Morris) |  | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | [github.com](https://github.com/seanmorris/php-wasm) |
| Sean Morris / php-wasm project | Sean Morris php-wasm runtime package |  | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | [github.com](https://github.com/seanmorris/php-wasm) |
| Securepoint GmbH | Securepoint Resellerportal |  | Investigation | Investigation | CVE assessment: Live vendor portal exposes Laravel application markers; exact PHP runtime and CVE scope unknown | [my.securepoint.de](https://my.securepoint.de/) [laravel.com](https://laravel.com/framework/docs/deployment) |
| Semantic MediaWiki project | Semantic MediaWiki |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/mediawiki/semantic-media-wiki) |
| Sendy | Sendy self-hosted application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [sendy.co](https://sendy.co/) [sendy.co](https://sendy.co/get-started) |
| Serendipity project | Serendipity Blog System |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.s9y.org](https://docs.s9y.org/docs/users/getting-started/fresh-installation.html) |
| Shaarli community | Shaarli | Shaarli Docker distribution awaiting a patched Alpine base at review time | Vulnerable | Vulnerable | CVE assessment: Shaarli's maintainer confirms that its Docker distribution needs the Alpine PHP security fix and that a new release is pending. This finding is scoped to the container runtime, not a Shaarli application-c | [github.com](https://github.com/shaarli/Shaarli/blob/master/composer.json) [github.com](https://github.com/shaarli/Shaarli/issues/2297#issuecomment-6320488435) |
| Shivam Mathur / setup-php project | setup-php GitHub Action external PHP provisioning | Patched setup-php v2-provisioned PHP builds announced 2026-10-21 | Fix | Fix | CVE assessment: The setup-php owner announces patched Linux, macOS and Windows PHP builds, including emergency EOL backports. This concerns the provisioned runtime; Windows, self-hosted runners and containers require upd | [github.com](https://github.com/shivammathur/setup-php/blob/main/action.yml) [github.com](https://github.com/shivammathur/setup-php/issues/1139) |
| Shlink project | Shlink |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/shlinkio/shlink) [github.com](https://github.com/shlinkio/shlink) |
| Shopify | Shopify API Library for PHP deprecated line |  | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | [packagist.org](https://packagist.org/packages/shopify/shopify-api) |
| Shopify | Shopify App PHP package |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/shopify/shopify-app-php) |
| Shopware 5 project / shopware AG lineage | Shopware 5 |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/shopware/shopware) |
| shopware AG | Shopware 6 |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.shopware.com](https://docs.shopware.com/en/shopware-6-en/update-guides/update-guide-shopware-67) [developer.shopware.com](https://developer.shopware.com/docs/v6.6/guides/installation/requirements.html) |
| Silverstripe CMS project | Silverstripe CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.silverstripe.org](https://docs.silverstripe.org/en/6/getting_started/server_requirements/) |
| Simple Machines / SMF project | Simple Machines Forum |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/SimpleMachines/SMF/blob/release-3.0/composer.json) |
| SimpleRisk | SimpleRisk PHP GRC application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [support.simplerisk.com](https://support.simplerisk.com/kb/01-01-system-requirements) |
| SimpleSAMLphp project | SimpleSAMLphp |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/simplesamlphp/simplesamlphp) |
| Slim project | Slim framework |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [packagist.org](https://packagist.org/packages/slim/slim) |
| SnappyMail project | SnappyMail |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/the-djmaze/snappymail) |
| SolidWorx / SolidInvoice project | SolidInvoice application |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/SolidInvoice/SolidInvoice/blob/3.2.x/composer.json) [github.com](https://github.com/SolidInvoice/SolidInvoice) |
| SolidWorx / SolidInvoice project | SolidInvoice self-contained binary |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [solidinvoice.co](https://solidinvoice.co/docs/installation-guide/quick-install/) |
| Sophos | MyUTM portal |  | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | [sophos.com](https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell) |
| SPIP project | SPIP |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [spip.net](https://www.spip.net/en_article6659.html) |
| Spryker Systems GmbH | Spryker Commerce OS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.spryker.com](https://docs.spryker.com/docs/dg/dev/system-requirements/latest/system-requirements.html) [docs.spryker.com](https://docs.spryker.com/docs/dg/dev/upgrade-and-migrate/upgrade-to-php-85) |
| SquirrelMail project | SquirrelMail legacy documented webmail |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [squirrelmail.org](https://www.squirrelmail.org/docs/admin/admin-3.html) |
| Statamic project | Statamic CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [statamic.dev](https://statamic.dev/getting-started/requirements) |
| Statamic project | Statamic static-site generator |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [statamic.dev](https://statamic.dev/getting-started/deploying/netlify) |
| Stripe and contributors | Stripe PHP client library |  | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | [packagist.org](https://packagist.org/packages/stripe/stripe-php) |
| SugarAI / SugarCRM | Sugar application server |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [support.sugarai.com](https://support.sugarai.com/resources/supported_platforms/) |
| Sulu project | Sulu CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.sulu.io](https://docs.sulu.io/3.x/reference/requirements.html) |
| SURF | SURF Research Access Management EngineBlock proxy |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [servicedesk.surf.nl](https://servicedesk.surf.nl/wiki/spaces/IAM/pages/74226103/Conceptual%2Boverview%2Bof%2BSURF%2BResearch%2BAccess%2BManagement) [github.com](https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json) [github.com](https://github.com/SURFscz/SBS) |
| SURF | SURF Research Drive Nextcloud server component |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [surf.nl](https://www.surf.nl/files/2026-04/surf-dienstdomeinvisies-slidedeck.pdf) [docs.nextcloud.com](https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html) |
| SURF | SURFconext OpenConext EngineBlock proxy role |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [openconext.org](https://openconext.org/openconext-showcases/) [openconext.org](https://openconext.org/openconext-building-blocks/) [github.com](https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json) |
| SURF | SURFdrive Nextcloud server component |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [surf.nl](https://www.surf.nl/diensten/opslag-datamanagement/surfdrive) [docs.nextcloud.com](https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html) |
| SURF | SURFfilesender FileSender server component |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [surf.nl](https://www.surf.nl/diensten/opslag-datamanagement/surffilesender) [docs.filesender.org](https://docs.filesender.org/filesender/v3.0/install/) |
| SURF / SURFnet | SURFconext Service Provider Dashboard |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/SURFnet/sp-dashboard/blob/main/composer.json) [github.com](https://github.com/SURFnet/sp-dashboard) |
| SUSE | SUSE Linux Enterprise PHP8 package families |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [documentation.suse.com](https://documentation.suse.com/releasenotes/sles/15-SP6/index.html) [suse.com](https://www.suse.com/support/update/announcement/2026/suse-su-20264651-1/) |
| SUSE | SUSE SLE BCI PHP CLI container |  | Not vuln | Not vuln | CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image d | [registry.suse.com](https://registry.suse.com/repositories/bci-php) [lists.suse.com](https://lists.suse.com/pipermail/sle-container-updates/2026-September/012564.html) [suse.com](https://www.suse.com/security/cve/CVE-2026-109618.html) |
| SUSE | SUSE SLE BCI PHP-Apache container |  | Not vuln | Not vuln | CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image d | [registry.suse.com](https://registry.suse.com/repositories/bci-php-apache) [lists.suse.com](https://lists.suse.com/pipermail/sle-container-updates/2026-September/012562.html) [suse.com](https://www.suse.com/security/cve/CVE-2026-109618.html) |
| SUSE | SUSE SLE BCI PHP-FPM 8 container |  | Not vuln | Not vuln | CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image d | [registry.suse.com](https://registry.suse.com/repositories/bci-php-fpm) [lists.suse.com](https://lists.suse.com/pipermail/sle-container-updates/2026-September/012563.html) [suse.com](https://www.suse.com/security/cve/CVE-2026-109618.html) |
| Swoole project | Swoole native PHP extension |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [pecl.php.net](https://pecl.php.net/package/swoole/6.2.3) |
| Sylius project | Sylius |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [docs.sylius.com](https://docs.sylius.com/public/getting-started/before-you-begin) |
| Sylvain Lassaut / NoiseByNorthwest | SPX native PHP profiling extension and built-in report UI |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [github.com](https://github.com/NoiseByNorthwest/php-spx/blob/master/README.md) [github.com](https://github.com/NoiseByNorthwest/php-spx/blob/master/config.m4) |
| Symfony | Symfony Console component |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/symfony/console) |
| Symfony | Symfony framework |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | [symfony.com](https://symfony.com/doc/current/setup.html) [symfony.com](https://symfony.com/components) [packagist.org](https://packagist.org/packages/symfony/http-foundation) |
| Symfony | Symfony HttpFoundation component |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/symfony/http-foundation) |
| Symfony | Symfony HttpKernel component |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/symfony/http-kernel) |
| Symfony | Symfony mbstring polyfill |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/symfony/polyfill-mbstring) |
| Symfony | Symfony Process component |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [packagist.org](https://packagist.org/packages/symfony/process) |
| Symplify | Easy Coding Standard PHP style tool |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [packagist.org](https://packagist.org/packages/symplify/easy-coding-standard) |
| Synology | Synology PHP 5.6 archived package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [archive.synology.com](https://archive.synology.com/download/Package/PHP5.6/5.6.40-0131) [archive.synology.com](https://archive.synology.com/download/Package/PHP5.6) |
| Synology | Synology PHP 7.0 archived package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [archive.synology.com](https://archive.synology.com/download/Package/PHP7.0/7.0.33-0131) [archive.synology.com](https://archive.synology.com/download/Package/PHP7.0) |
| Synology | Synology PHP 7.2 archived package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [archive.synology.com](https://archive.synology.com/download/Package/PHP7.2/7.2.34-0131) [archive.synology.com](https://archive.synology.com/download/Package/PHP7.2) |
| Synology | Synology PHP 7.3 archived package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [archive.synology.com](https://archive.synology.com/download/Package/PHP7.3/7.3.33-0173) [archive.synology.com](https://archive.synology.com/download/Package/PHP7.3) |
| Synology | Synology PHP 7.4 archived package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [archive.synology.com](https://archive.synology.com/download/Package/PHP7.4/7.4.33-0140) [archive.synology.com](https://archive.synology.com/download/Package/PHP7.4) |
| Synology | Synology PHP 8.0 archived package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [archive.synology.com](https://archive.synology.com/download/Package/PHP8.0/8.0.30-0121) [archive.synology.com](https://archive.synology.com/download/Package/PHP8.0) |
| Synology | Synology PHP 8.1 archived package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [archive.synology.com](https://archive.synology.com/download/Package/PHP8.1/8.1.34-0110) [archive.synology.com](https://archive.synology.com/download/Package/PHP8.1) |
| Synology | Synology PHP 8.2 archived package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [archive.synology.com](https://archive.synology.com/download/Package/PHP8.2/8.2.30-0170) [archive.synology.com](https://archive.synology.com/download/Package/PHP8.2) |
| Synology | Synology PHP 8.3 archived package family |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [archive.synology.com](https://archive.synology.com/download/Package/PHP8.3/8.3.30-0050) [archive.synology.com](https://archive.synology.com/download/Package/PHP8.3) |
| Synology | Synology PHP 8.4 package distribution |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [archive.synology.com](https://archive.synology.com/download/Package/PHP8.4/8.4.19-0050) [archive.synology.com](https://archive.synology.com/download/Package/PHP8.4) |
| Synology | Synology Web Station optional PHP hosting |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [synology.com](https://www.synology.com/en-global/dsm/7.4/software_spec/web_station) |
| TeamPass project | TeamPass |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/nilsteampassnet/TeamPass) [github.com](https://github.com/nilsteampassnet/TeamPass/blob/master/composer.json) |
| TerraMaster | TerraMaster TOS6 Web Server optional PHP hosting |  | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | [help.terra-master.com](https://help.terra-master.com/docs/TOS6/application/web-server) |
| Textpattern project | Textpattern CMS |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [textpattern.com](https://textpattern.com/about/system-requirements) [textpattern.com](https://textpattern.com/weblog/textpattern-490-released-php-85-mysql-84-features-fixes-fine-tuning-and-much-more) |
| The Cacti Group | Cacti |  | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | [github.com](https://github.com/Cacti/cacti/blob/develop/composer.json) [github.com](https://github.com/Cacti/cacti) |
| The PHP Foundation / PHP PIE project | PHP Installer for Extensions (PIE) |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [github.com](https://github.com/php/pie) [pecl.php.net](https://pecl.php.net/) [packagist.org](https://packagist.org/extensions) |
| The PHP Group | PHP BCMath |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bcmath/config.m4) [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bcmath/config.w32) |
| The PHP Group | PHP built-in development web server |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cli/php_cli_server.c) [php.net](https://www.php.net/manual/en/features.commandline.webserver.php) |
| The PHP Group | PHP Bzip2 |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bz2/config.m4) [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bz2/config.w32) |
| The PHP Group | PHP Calendar |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/calendar/config.m4) [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/calendar/config.w32) |
| The PHP Group | PHP Clang fuzzer SAPI |  | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/fuzzer/config.m4) |
| The PHP Group | PHP CLI |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cli/config.m4) [docs.phpunit.de](https://docs.phpunit.de/en/12.5/installation.html) |
| The PHP Group | PHP COM and .NET |  | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/com_dotnet/config.w32) |
| The PHP Group | PHP core and Zend Engine |  | none | none | Unversioned PHP runtime family anchor for downstream dependency links; version-scoped affected and fixed runtime variants are recorded separately. | [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/Zend/zend.c) [raw.githubusercontent.com](https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/main/main.c) [php.net](https://www.php.net/supported-versions.php) |
| The PHP Group | PHP core and Zend Engine affected web-serving release scope | >=5.4.0 before fixed release or vendor backport; supported branches


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/affected/software.html